How Secure is my Social Security Number?
When Social Security numbers were first issued in 1936, the federal government assured the public that use of the numbers would be limited to Social Security programs. Today, however, the Social Security number (SSN) is the most frequently used recordkeeping number in the United States. SSNs are used for employee files, medical records, health insurance accounts, credit and banking accounts, university ID cards, and many other purposes. In fact, the Social Security number is now required for dependents over one year of age if the parents claim the child for tax purposes.
Why is my Social Security number used so often as an identification number?
Computer records have replaced paper filing systems in most organizations. Since more than one person may share the same name, accurate retrieval of information works best if each file is assigned a unique number. Many businesses and government agencies believe the Social Security number is tailor-made for this purpose. However, with the rise in the crime of identity theft and other illegitimate uses of the SSN, this assumption is not valid.
Why is it important to keep the Social Security number private?
The crime of identity theft is increasing at epidemic proportions. With the Social Security number accessible to so many people, it is relatively easy for someone to fraudulently use your SSN to assume your identity and gain access to your bank account, credit accounts, utilities records, and other sources of personal information. Identity thieves can also establish new credit and bank accounts in your name. (See article on identity theft.)
Your Social Security number is also frequently used as your identification number in many computer files, giving access to information you may want kept private and allowing an easy way of linking data bases. Therefore, it is wise to limit access to your Social Security number whenever possible.
Am I required to give my Social Security number to government agencies?
It depends upon the agency. Some government agencies, including tax authorities, welfare offices and state Departments of Motor Vehicles, can require your Social Security number as mandated by federal law (42 USC 405 (c)(2)(C)(v) and (i)). Others may request the SSN in such a manner that you are led to believe you must provide it.
The Privacy Act of 1974 requires all government agencies -- federal, state and local -- that request SSNs to provide a "disclosure" statement on the form. The statement explains if you are required to provide your Social Security number or if it is optional, how the SSN will be used, and under what statutory or other authority the number is requested (5 USC 552a, note). The U.S. Office of Management and Budget, Office of Information and Regulatory Affairs (OIRA) provides guidance and oversight regarding the Privacy Act of 1974. The text of the Privacy Act can be found at the website www.usdoj.gov/foia/privstat.htm.
The Privacy Act states that you cannot be denied a government benefit or service if you refuse to disclose your SSN unless the disclosure is required by federal law, or the disclosure is to an agency which has been using SSNs previous to January 1975, the date when the Privacy Act went into effect. There are other exceptions as well. Read the U.S. Department of Justice's explanation at this website, www.usdoj.gov/04foia/1974ssnu.htm.
If you are asked to give your Social Security number to a government agency and no disclosure statement is included on the form, complain and cite the Privacy Act. Unfortunately, there appear to be no penalties when a government agency fails to provide a disclosure statement.
Do I have to provide my Social Security number to private businesses?
Usually you are not legally compelled to provide your Social Security number to private businesses -- including private health care providers and insurers -- unless you are involved in a transaction in which the Internal Revenue Service requires notification. (MediCal and Medicare are government health plans and can require a Social Security number.)
There is no law, however, that prevents businesses from requesting your SSN, and there are few restrictions on what businesses can do with it. But even though you are not required to disclose your SSN, the business does not have to provide you with service if you refuse to release it.
If a business insists on knowing your Social Security number when you cannot see a reason for it, speak to an administrator who may be authorized to make an exception or who may know that company policy does not require it. If the company will not allow you to use an alternate number, you may want to take your business elsewhere.
Credit card applications usually request Social Security numbers. Your number is used primarily to verify your identity in situations where you have the same or a similar name to others. Although most credit grantors will insist on having your SSN, you may be able to find a credit grantor who will provide you credit without knowing your SSN, especially if you are persistent and can provide other forms of identification. But such instances are rare.
In California, a new law restricts how certain businesses can display their customers’ Social Security numbers. It does not restrict the collection of SSNs, however, and it does not affect government agencies. California Civil Code 1798.95 is being phased in from 2003 to 2005. Insurance companies will not be able to print the SSN on identification cards to be carried in the wallet. Customers of banks and investment companies cannot be required to transmit the SSN over the Internet when conducting business online, unless the number is encrypted. SSNs cannot be printed on documents sent through the mail, with some exceptions. The California Office of Privacy Protection provides a guide for businesses on “recommended practices” for using SSNs. It includes a description of the new law, www.privacy.ca.gov/recommendations/ssnrecommendations.pdf. The full text of the law is found on the state’s official legislative web site, www.leginfo.ca.gov.
Should I provide my Social Security number over the Internet?
Many individuals now shop on the Internet. In some instances a commercial website might require your SSN, for example if you apply for a credit card online. We advise that you take extra precautions to determine that your personal data is transmitted securely and that it is stored safely by the online business.
Be on the alert for unsolicited electronic mail messages in which your SSN and other personal information are requested. Many individuals report having received e-mail messages that appear to be from their Internet Service provider, for example AOL, or from a government agency like the Internal Revenue Service. The message typically states that the company or agency is updating its records and that it needs certain information from you, such as Social Security number. Do not respond to such messages. Even though they appear to be official, these messages and/or websites are a scam. No reputable company or government agency sends unsolicited e-mail messages to individuals in which sensitive personal data is sought in this manner.
Can my employer use my SSN as an employee identification number?
Yes. However, the Social Security Administration discourages employers from displaying Social Security numbers on documents that are viewed by other people such as badges, parking permits, or on lists distributed to employees. Employers do, however, need each employees’ Social Security number to report earnings and payroll taxes.
Why do financial transactions require my Social Security number?
In 1961 the Internal Revenue Service began using Social Security numbers as taxpayer ID numbers (TIN). Therefore, SSNs are required on records of transactions in which the IRS is interested. That includes most banking, stock market, property or other financial transactions as well as employment records. Since your Social Security number must be included on all of these sensitive financial documents, it is important to limit other uses of the number.
How can a school use my Social Security number?
Publicly-funded schools and those that receive federal funding must comply with the Family Educational Rights and Privacy Act in order to retain their funding (FERPA, also known as the "Buckley Amendment," enacted in 1974, 20 USC 1232g). One of FERPA's provisions requires written consent for the release of educational records or personally identifiable information, with some exceptions. The courts have stated that Social Security numbers fall within this provision.
FERPA applies to state colleges, universities and technical schools that receive federal funding. An argument can be made that if such a school displays students' SSNs on identification cards or distributes class rosters or grades listings containing SSNs, it would be a release of personally identifiable information, violating FERPA. However, many schools and universities have not interpreted the law this way and continue to use SSNs as a student identifier. To succeed in obtaining an alternate number to the SSN, you will probably need to be persistent and cite the law. Social Security numbers may be obtained by colleges and universities for students who have university jobs and/or receive federal financial aid. In Krebs v. Rutgers, the court ruled that SSNs are "educational records" under FERPA (Krebs v. Rutgers, 797 F. Supp. 1246 (D.N.J. 1992)).
The FERPA text can be found at the web, www.cpsr.org/cpsr/privacy/ssn/ferpa.buckley.html. For the U.S. Department of Education’s web site on FERPA, see www.ed.gov/offices/OM/fpco/ferpa/index.html.
Public schools, colleges and universities that ask for your SSN fall within the provisions of another federal law, the Privacy Act of 1974. This act requires such schools to provide a disclosure statement telling students how the Social Security number is used. If you are required to provide your SSN, be sure to look for the school's disclosure statement. If one is not offered, you may want to file a complaint with the school, citing the Privacy Act.
When the school is a private institution, your only recourse is to work with the administration to change the policy or at least to let you use an alternate identification number as your student ID.
How can I avoid releasing my Social Security number?
Here are some strategies to protect your Social Security number:
1. Adopt an active policy of not giving out your SSN unless you are convinced it is required or is to your benefit. Make people show you why it is needed.
2. Never print your Social Security number on your checks, business cards, address labels or other identifying information. Do not carry your SSN card in your wallet, or other cards containing the SSN. Your wallet could be lost or stolen. Attempt to resist merchants' requests to write your SSN onto your checks. Explain how you could become a victim of fraud if someone were to use your SSN and account number to gain access to your bank or credit accounts, or to open new accounts in your name.
3. Pay attention to your Social Security Personal Earnings and Benefit Estimate Statement. The Social Security Administration (SSA) mails it each year about three months before your birthday. Be certain the information in the file is correct. You can also contact the SSA at (800) 772-1213 to learn how to obtain this free report. If incorrect information is recorded, contact the SSA immediately. Someone may be fraudulently using your SSN for employment purposes. The Social Security Administration’s fraud department can be reached at (800) 269-0271. Its website is www.ssa.gov.
4. Order a copy of your credit report each year. If you are a victim of identity theft, the credit report will contain evidence of credit or banking fraud committed using your name and SSN. It will also show other SSNs associated with your name.
If a private business requests your Social Security number:
Leave the space for the SSN on the form blank or write "refused" or N/A in that space.
Speak to someone in authority or write to the business and explain why you do not want your SSN used to identify you. If you do not receive satisfaction from the first person you contact, go to a person in the organization with more authority.
Insist that the company document its policy of requiring a Social Security number. If a written policy cannot be found or too much time is taken hunting for one, the business may allow you to use an alternate number.
Ask why your Social Security number is requested and suggest alternatives like your driver’s license number (except if your driver’s license number is the SSN).
If the company insists on having your Social Security number, tell it you will take your business elsewhere. If the company persists, follow through on your promise.
6. In California, utilities cannot deny you service if you refuse to provide your Social Security number. However, a deposit may be required if you will not provide the information.
7. If your employer releases or displays your SSN, you may want to explain why you object. Most employers do not treat SSNs as confidential information. But they may be willing to change their policy when they understand the twin dangers of invasion of privacy and fraud.
8. If your bank, credit union or other financial service provider uses your Social Security number as a personal identification number (PIN) or as the identifier for banking by phone or the Internet, write a letter of complaint. Demand to have a different PIN and/or identification number assigned. Explain why the SSN is an extremely poor choice for a password or security code. If you use the last four digits of your SSN as your PIN for ATM and other banking or credit transactions, change it to something else, but not to a common number such as your birthdate.
9. If your state’s Department of Motor Vehicles uses the SSN as the driver’s license number, ask for an alternate number.